Pages preview #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pages preview | |
| on: | |
| workflow_run: | |
| workflows: | |
| - Website checks | |
| types: | |
| - completed | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| identity: | |
| name: Resolve trusted preview identity | |
| if: >- | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.event == 'pull_request' && | |
| github.event.workflow_run.head_repository.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branch: ${{ steps.identity.outputs.branch }} | |
| head_sha: ${{ steps.identity.outputs.head_sha }} | |
| pull_number: ${{ steps.identity.outputs.pull_number }} | |
| steps: | |
| - name: Resolve exact internal pull request | |
| id: identity | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const runId = context.payload.workflow_run.id | |
| const { data: run } = await github.rest.actions.getWorkflowRun({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| run_id: runId, | |
| }) | |
| if (run.name !== 'Website checks' || run.path !== '.github/workflows/website-check.yml') { | |
| core.setFailed('Preview must be orchestrated by the trusted Website checks workflow.') | |
| return | |
| } | |
| if (run.conclusion !== 'success' || run.event !== 'pull_request') { | |
| core.setFailed('Preview delivery requires a successful pull-request check run.') | |
| return | |
| } | |
| if (run.head_repository?.full_name !== `${context.repo.owner}/${context.repo.repo}`) { | |
| core.setFailed('Fork pull requests are not eligible for preview credentials.') | |
| return | |
| } | |
| const pulls = await github.rest.repos.listPullRequestsAssociatedWithCommit({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| commit_sha: run.head_sha, | |
| }) | |
| const pull = pulls.data.find((candidate) => | |
| candidate.state === 'open' && | |
| candidate.base.ref === 'main' && | |
| candidate.head.sha === run.head_sha && | |
| candidate.head.repo?.full_name === `${context.repo.owner}/${context.repo.repo}` | |
| ) | |
| if (!pull) { | |
| core.setFailed('Run is not the exact head of an eligible internal pull request.') | |
| return | |
| } | |
| core.setOutput('branch', `preview/docs/pr-${pull.number}`) | |
| core.setOutput('head_sha', run.head_sha) | |
| core.setOutput('pull_number', String(pull.number)) | |
| deploy: | |
| name: Deploy isolated pull-request preview | |
| needs: identity | |
| concurrency: | |
| group: pages-preview-docs-${{ needs.identity.outputs.pull_number }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| deployments: write | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: | |
| name: preview | |
| url: ${{ steps.pages.outputs.pages-deployment-alias-url }} | |
| steps: | |
| - name: Checkout the trusted preview controller | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.workflow_sha }} | |
| path: controller | |
| persist-credentials: false | |
| - name: Checkout the exact pull-request head | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.identity.outputs.head_sha }} | |
| path: candidate | |
| persist-credentials: false | |
| - name: Install the pinned pnpm release | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| with: | |
| package_json_file: candidate/website/package.json | |
| - name: Set up Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version-file: candidate/website/package.json | |
| cache: pnpm | |
| cache-dependency-path: candidate/website/pnpm-lock.yaml | |
| - name: Build the exact-head website preview | |
| run: | | |
| pnpm --dir candidate/website install --frozen-lockfile | |
| pnpm --dir candidate/website check | |
| - name: Prepare the isolated Pages delivery | |
| run: | | |
| mkdir --parents .pages-preview | |
| cp --recursive candidate/website/.vitepress/dist .pages-preview/dist | |
| - name: Deploy to the isolated Pages preview branch | |
| id: pages | |
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| packageManager: npm | |
| wranglerVersion: 4.114.0 | |
| workingDirectory: .pages-preview | |
| command: >- | |
| pages deploy dist | |
| --project-name=${{ vars.CLOUDFLARE_PAGES_PROJECT }} | |
| --branch=${{ needs.identity.outputs.branch }} | |
| --commit-hash=${{ needs.identity.outputs.head_sha }} | |
| --commit-dirty=false | |
| - name: Smoke-test the exact preview deployment | |
| run: node controller/website/scripts/verify-pages-deployment.mjs | |
| env: | |
| CLOUDFLARE_PAGES_DEPLOYMENT_ID: ${{ steps.pages.outputs.pages-deployment-id }} | |
| CLOUDFLARE_PAGES_DEPLOYMENT_URL: ${{ steps.pages.outputs.pages-deployment-alias-url }} | |
| INKCRE_PAGES_SMOKE_MODE: preview |